Privacy policy

BLOCKWORX GmbH, Wellishöfe 6 B, 79215 Elzach, Deutschland. Represented by the managing director Adrian Ziser. Register court Amtsgericht Freiburg, HRB 717547. VAT ID DE317655924. Contact: info@blockworx.de, https://blockworx.de. For PharmHub: info@pharmhub.de.

No data protection officer has been appointed (below the statutory threshold). Please address data protection requests to info@blockworx.de.

For the website, the customer account and the contract, BLOCKWORX is the controller. For all data a pharmacy processes in PharmHub (employee, customer and patient data), the pharmacy is the controller and BLOCKWORX is the processor under Art. 28 GDPR on the basis of a data processing agreement.

Server logs (IP address, time, page requested) are kept for 14 days for operational security, Art. 6 (1)(f) GDPR. Cookies are strictly technically necessary (pharmhub_session, pharmhub_csrf). No analytics, no tracking, no third-party scripts.

Name, e-mail address and message are processed to handle the enquiry, Art. 6 (1)(b) GDPR. Deleted once the enquiry is closed, at the latest after 12 months.

When you book through a pharmacy's booking page, the pharmacy, as controller, processes your name, contact details and appointment data; for pharmaceutical services and vaccinations, health data under Art. 9 (2)(a) GDPR on the basis of the explicit consent given in the booking dialogue (recorded with its version). BLOCKWORX stores this data solely on behalf of the pharmacy.

Video consultations run on a video server operated by BLOCKWORX in Germany. Recordings are made only with separate consent and are stored on behalf of the pharmacy.

Contract data is processed under Art. 6 (1)(b) GDPR. Payment processing: Stripe Payments Europe Ltd., Dublin. BLOCKWORX never receives complete payment data.

Hetzner Online GmbH (servers and video storage, Germany); Backblaze Inc. (document storage, EU data centre, standard contractual clauses).

E-mail delivery and error logging run on BLOCKWORX's own servers. App push notifications are delivered via Google Firebase Cloud Messaging on Android and via Apple Push Notification service on iOS (device token only, no content in either case).

AI-assisted features in the QM module are switched off for every pharmacy by default and are only used if the pharmacy explicitly enables them. In that case we use the following additional processors (sub-processors under Art. 28(4) GDPR): Cortecs GmbH, Vienna, Austria (text generation, processing in the EU, no retention of requests - zero data retention); Berget AI AB, Stockholm, Sweden (text generation as a fallback provider if Cortecs is unavailable); Microsoft Ireland Operations Ltd. with Azure OpenAI in the EU data zone (embeddings for document search). Only content from the QM module is transmitted, i.e. QM documents and the free text entered there into AI features. Patient data is never transmitted. QM documents marked as confidential are never processed for document search and are only passed to an AI feature when an authorised member of their circle triggers this themselves.

Contract data for the commercial and tax retention periods; pharmacy data as instructed by the pharmacy; operational logs for 14 days.

You have the right to access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent given.

Complaints: The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

Encrypted transport, role-based access, tenant separation at database level, tamper-evident logging of access to health data.